@camstack/core 0.1.37 → 0.1.39

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/core",
-  "version": "0.1.37",
+  "version": "0.1.39",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",
@@ -31,6 +31,7 @@
     "addons": [
       {
         "id": "filesystem-storage",
+        "category": "system",
         "name": "Filesystem Storage",
         "entry": "./dist/builtins/sqlite-storage/filesystem-storage.addon.js",
         "capabilities": [
@@ -41,6 +42,7 @@
       },
       {
         "id": "sqlite-settings",
+        "category": "system",
         "name": "SQLite Settings",
         "entry": "./dist/builtins/sqlite-storage/sqlite-settings.addon.js",
         "capabilities": [
@@ -51,6 +53,7 @@
       },
       {
         "id": "winston-logging",
+        "category": "system",
         "name": "Winston Logging",
         "entry": "./dist/builtins/winston-logging/index.js",
         "capabilities": [
@@ -61,6 +64,7 @@
       },
       {
         "id": "console-logging",
+        "category": "system",
         "name": "Console Logging",
         "entry": "./dist/builtins/console-logging/index.js",
         "capabilities": [
@@ -71,6 +75,7 @@
       },
       {
         "id": "hub-forwarder",
+        "category": "system",
         "name": "Hub Log Forwarder",
         "description": "Agent-only log destination — forwards every log entry to the hub via the cluster broker. Never runs on the hub itself (the hub already owns the log-receiver, registering hub-forwarder there would create a write→ingest→write feedback loop).",
         "entry": "./dist/builtins/hub-forwarder/index.js",
@@ -85,6 +90,7 @@
       },
       {
         "id": "backup-orchestrator",
+        "category": "system",
         "name": "Backup Orchestrator",
         "description": "System singleton that owns the schedule, builds the archive once, and fans it out to every enabled `backup-destination` provider (local, S3, rsync, …). In-process on hub root — aggregator over a cluster collection, no native deps.",
         "entry": "./dist/builtins/backup-orchestrator/index.js",
@@ -97,6 +103,7 @@
       },
       {
         "id": "storage-orchestrator",
+        "category": "system",
         "name": "Storage Orchestrator",
         "description": "Hub-only singleton that owns the consumer-facing `storage` cap. Holds the `locationId → StorageLocation` map, resolves `StorageLocationRef` to concrete locations, and dispatches every call to the matching `storage-provider` collection registrant (`filesystem-storage` today; future SFTP / S3 / WebDAV addons plug in alongside).",
         "entry": "./dist/builtins/storage-orchestrator/index.js",
@@ -109,6 +116,7 @@
       },
       {
         "id": "metrics-native",
+        "category": "system",
         "name": "Native Metrics",
         "entry": "./dist/builtins/native-metrics/native-metrics.addon.js",
         "capabilities": [
@@ -119,6 +127,7 @@
       },
       {
         "id": "snapshot",
+        "category": "system",
         "name": "Snapshot",
         "entry": "./dist/builtins/snapshot/index.js",
         "capabilities": [
@@ -129,6 +138,7 @@
       },
       {
         "id": "alert-center",
+        "category": "system",
         "name": "Alert Center",
         "entry": "./dist/builtins/alerts/index.js",
         "capabilities": [
@@ -139,6 +149,7 @@
       },
       {
         "id": "system-config",
+        "category": "system",
         "name": "System Config",
         "description": "Exposes cluster-wide yml-backed configuration sections (server, auth, ffmpeg, logging, recording, retention) via the three-level settings API. Hub-only.",
         "entry": "./dist/builtins/system-config/index.js",
@@ -146,6 +157,7 @@
       },
       {
         "id": "addon-pages-aggregator",
+        "category": "system",
         "name": "Addon Pages Aggregator",
         "description": "Hub-only singleton that aggregates `addon-pages-source` (collection) providers and emits the public `addon-pages.listPages` surface with versioned bundleUrls.",
         "entry": "./dist/builtins/addon-pages-aggregator/index.js",
@@ -158,6 +170,7 @@
       },
       {
         "id": "addon-widgets-aggregator",
+        "category": "system",
         "name": "Addon Widgets Aggregator",
         "description": "Hub-only singleton that aggregates `addon-widgets-source` (collection) providers and emits the public `addon-widgets.listWidgets` surface with versioned bundleUrls.",
         "entry": "./dist/builtins/addon-widgets-aggregator/index.js",
@@ -170,6 +183,7 @@
       },
       {
         "id": "device-manager",
+        "category": "system",
         "name": "Device Manager",
         "description": "Hub-side singleton that unifies device persistence and management. Uses ctx.settings for storage — no direct SQLite access. Replaces device-persistence cap (Phase 2 will delete device-persistence once all consumers are migrated).",
         "entry": "./dist/builtins/device-manager/index.js",
@@ -185,6 +199,7 @@
       },
       {
         "id": "local-auth",
+        "category": "system",
         "name": "Local Auth",
         "description": "Built-in local username/password authentication. Implements the auth-provider capability as the default login path. OIDC and other providers can register alongside via the same capability.",
         "entry": "./dist/builtins/local-auth/index.js",
@@ -200,6 +215,7 @@
       },
       {
         "id": "platform-probe",
+        "category": "system",
         "name": "Platform Probe (Native)",
         "description": "Probes hardware and inference runtimes on the local node. Registers the `platform-probe` capability consumed by every inference addon on this node.",
         "entry": "./dist/builtins/platform-probe/index.js",
@@ -215,6 +231,7 @@
       },
       {
         "id": "local-network",
+        "category": "system",
         "name": "Local Network",
         "description": "Enumerates the hub's network interfaces, classifies them (LAN / Wi-Fi / Docker / VPN / loopback), and ranks connection-endpoints for SDK clients. Hub-only — agents are not directly addressable.",
         "entry": "./dist/builtins/local-network/index.js",
@@ -225,32 +242,9 @@
           }
         ]
       },
-      {
-        "id": "auth-orchestrator",
-        "name": "Authentication Orchestrator",
-        "description": "Hub-only singleton facade over the auth-provider collection. Surfaces a unified provider list to the admin UI's Authentication page and the login screen's provider picker.",
-        "entry": "./dist/builtins/auth-orchestrator/index.js",
-        "protected": true,
-        "capabilities": [
-          {
-            "name": "authentication"
-          }
-        ]
-      },
-      {
-        "id": "mesh-orchestrator",
-        "name": "Mesh Orchestrator",
-        "description": "Hub-only singleton facade over the mesh-network collection. Aggregates Tailscale / Headscale / ZeroTier providers for the admin UI's Mesh Networks page.",
-        "entry": "./dist/builtins/mesh-orchestrator/index.js",
-        "protected": true,
-        "capabilities": [
-          {
-            "name": "mesh-orchestrator"
-          }
-        ]
-      },
       {
         "id": "remote-access-orchestrator",
+        "category": "system",
         "name": "Remote Access Orchestrator",
         "description": "Hub-only singleton facade over the network-access collection (Cloudflare Tunnel, ngrok, …). Surfaces a unified provider list to the admin UI's Remote Access page.",
         "entry": "./dist/builtins/remote-access-orchestrator/index.js",
@@ -260,18 +254,6 @@
             "name": "remote-access"
           }
         ]
-      },
-      {
-        "id": "turn-orchestrator",
-        "name": "TURN Orchestrator",
-        "description": "Hub-only singleton facade over the turn-provider collection. Aggregates ICE servers from all enabled TURN providers; consumed by the WebRTC layer at session creation.",
-        "entry": "./dist/builtins/turn-orchestrator/index.js",
-        "protected": true,
-        "capabilities": [
-          {
-            "name": "turn-orchestrator"
-          }
-        ]
       }
     ]
   },

package/dist/builtins/auth-orchestrator/auth-orchestrator.addon.d.ts

@@ -1,8 +0,0 @@
-import { BaseAddon, ProviderRegistration } from '@camstack/types';
-export declare class AuthOrchestratorAddon extends BaseAddon<Record<string, never>> {
-    constructor();
-    protected onInitialize(): Promise<ProviderRegistration[]>;
-    private listProviders;
-}
-export default AuthOrchestratorAddon;
-//# sourceMappingURL=auth-orchestrator.addon.d.ts.map

package/dist/builtins/auth-orchestrator/auth-orchestrator.addon.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-orchestrator.addon.d.ts","sourceRoot":"","sources":["../../../src/builtins/auth-orchestrator/auth-orchestrator.addon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,SAAS,EAIT,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAA;AA4BxB,qBAAa,qBAAsB,SAAQ,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;;cAKzD,YAAY,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAgBjD,aAAa;CAoC5B;AAED,eAAe,qBAAqB,CAAA"}

package/dist/builtins/auth-orchestrator/auth-orchestrator.addon.js

@@ -1,75 +0,0 @@
-Object.defineProperties(exports, {
-	__esModule: { value: true },
-	[Symbol.toStringTag]: { value: "Module" }
-});
-require("../../chunk-C13QxCFV.js");
-let _camstack_types = require("@camstack/types");
-//#region src/builtins/auth-orchestrator/auth-orchestrator.addon.ts
-/**
-* Authentication orchestrator — singleton facade over the
-* `auth-provider` collection. Mirrors the backup-orchestrator pattern:
-* UI consumers go through this builtin, which walks the
-* `auth-provider` collection registered by `local-auth` and any
-* additional `auth-*` addons (OIDC, SAML, LDAP, …) and returns a
-* curated view.
-*
-* The actual login flow still goes through `auth-provider`
-* collection methods (validateCredentials / getLoginUrl / …); this
-* cap exists so the admin UI's "Authentication" page and the login
-* screen's provider picker have ONE place to query instead of
-* walking the collection themselves.
-*/
-var AuthOrchestratorAddon = class extends _camstack_types.BaseAddon {
-	constructor() {
-		super({});
-	}
-	async onInitialize() {
-		const provider = {
-			listProviders: async () => this.listProviders(),
-			setProviderEnabled: async () => {
-				return { success: true };
-			}
-		};
-		this.ctx.logger.info("Authentication orchestrator initialized");
-		return [{
-			capability: _camstack_types.authenticationCapability,
-			provider
-		}];
-	}
-	async listProviders() {
-		const entries = this.capabilities?.getCollectionEntries("auth-provider") ?? [];
-		const out = [];
-		for (const [addonId, raw] of entries) {
-			if (raw?.instances && raw.instances.length > 0) {
-				for (const inst of raw.instances) out.push({
-					addonId: raw.addonId ?? addonId,
-					instanceId: inst.instanceId,
-					displayName: inst.displayName,
-					...inst.icon !== void 0 ? { icon: inst.icon } : {},
-					hasRedirectFlow: inst.hasRedirectFlow,
-					hasCredentialFlow: inst.hasCredentialFlow,
-					...inst.kind !== void 0 ? { kind: inst.kind } : {},
-					...inst.status !== void 0 ? { status: inst.status } : {},
-					enabled: true
-				});
-				continue;
-			}
-			out.push({
-				addonId: raw?.addonId ?? addonId,
-				displayName: raw?.displayName ?? addonId,
-				...raw?.icon !== void 0 ? { icon: raw.icon } : {},
-				hasRedirectFlow: raw?.hasRedirectFlow ?? false,
-				hasCredentialFlow: raw?.hasCredentialFlow ?? addonId === "local-auth",
-				...raw?.kind !== void 0 ? { kind: raw.kind } : {},
-				...raw?.status !== void 0 ? { status: raw.status } : {},
-				enabled: true
-			});
-		}
-		return out;
-	}
-};
-//#endregion
-exports.AuthOrchestratorAddon = AuthOrchestratorAddon;
-exports.default = AuthOrchestratorAddon;
-
-//# sourceMappingURL=auth-orchestrator.addon.js.map

package/dist/builtins/auth-orchestrator/auth-orchestrator.addon.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-orchestrator.addon.js","names":[],"sources":["../../../src/builtins/auth-orchestrator/auth-orchestrator.addon.ts"],"sourcesContent":["/**\n * Authentication orchestrator — singleton facade over the\n * `auth-provider` collection. Mirrors the backup-orchestrator pattern:\n * UI consumers go through this builtin, which walks the\n * `auth-provider` collection registered by `local-auth` and any\n * additional `auth-*` addons (OIDC, SAML, LDAP, …) and returns a\n * curated view.\n *\n * The actual login flow still goes through `auth-provider`\n * collection methods (validateCredentials / getLoginUrl / …); this\n * cap exists so the admin UI's \"Authentication\" page and the login\n * screen's provider picker have ONE place to query instead of\n * walking the collection themselves.\n */\nimport {\n  BaseAddon,\n  authenticationCapability,\n  type AuthProviderInfo,\n  type IAuthenticationProvider,\n  type ProviderRegistration,\n} from '@camstack/types'\n\ninterface AuthProviderRegistrationLike {\n  readonly addonId?: string\n  readonly displayName?: string\n  readonly icon?: string\n  readonly hasRedirectFlow?: boolean\n  readonly hasCredentialFlow?: boolean\n  readonly kind?: string\n  readonly status?: string\n  /**\n   * Multi-instance fan-out. When set, the orchestrator emits ONE\n   * AuthProviderInfo per entry instead of a single one for the\n   * collection entry. Used by addons that host multiple logical IdPs\n   * within a single install (the OIDC addon supports Google +\n   * Microsoft + custom from one installation).\n   */\n  readonly instances?: ReadonlyArray<{\n    readonly instanceId: string\n    readonly displayName: string\n    readonly icon?: string\n    readonly hasRedirectFlow: boolean\n    readonly hasCredentialFlow: boolean\n    readonly kind?: string\n    readonly status?: string\n  }>\n}\n\nexport class AuthOrchestratorAddon extends BaseAddon<Record<string, never>> {\n  constructor() {\n    super({})\n  }\n\n  protected async onInitialize(): Promise<ProviderRegistration[]> {\n    const provider: IAuthenticationProvider = {\n      listProviders: async () => this.listProviders(),\n      setProviderEnabled: async () => {\n        // Persistence is per-addon today — operators toggle enabled\n        // via the provider addon's own settings panel. The orchestrator\n        // exposes the affordance for forward-compat (UI may move the\n        // enabled toggle into the Authentication page later) but\n        // currently no-ops the persistence side.\n        return { success: true as const }\n      },\n    }\n    this.ctx.logger.info('Authentication orchestrator initialized')\n    return [{ capability: authenticationCapability, provider }]\n  }\n\n  private async listProviders(): Promise<readonly AuthProviderInfo[]> {\n    const entries = this.capabilities?.getCollectionEntries<AuthProviderRegistrationLike>('auth-provider') ?? []\n    const out: AuthProviderInfo[] = []\n    for (const [addonId, raw] of entries) {\n      // Multi-instance: emit one entry per declared instance, preserving\n      // the parent `addonId` so the login URL keeps `/addon/<addonId>/...`\n      // while adding the `instanceId` path segment downstream.\n      if (raw?.instances && raw.instances.length > 0) {\n        for (const inst of raw.instances) {\n          out.push({\n            addonId: raw.addonId ?? addonId,\n            instanceId: inst.instanceId,\n            displayName: inst.displayName,\n            ...(inst.icon !== undefined ? { icon: inst.icon } : {}),\n            hasRedirectFlow: inst.hasRedirectFlow,\n            hasCredentialFlow: inst.hasCredentialFlow,\n            ...(inst.kind !== undefined ? { kind: inst.kind } : {}),\n            ...(inst.status !== undefined ? { status: inst.status } : {}),\n            enabled: true,\n          })\n        }\n        continue\n      }\n      out.push({\n        addonId: raw?.addonId ?? addonId,\n        displayName: raw?.displayName ?? addonId,\n        ...(raw?.icon !== undefined ? { icon: raw.icon } : {}),\n        hasRedirectFlow: raw?.hasRedirectFlow ?? false,\n        hasCredentialFlow: raw?.hasCredentialFlow ?? (addonId === 'local-auth'),\n        ...(raw?.kind !== undefined ? { kind: raw.kind } : {}),\n        ...(raw?.status !== undefined ? { status: raw.status } : {}),\n        enabled: true,\n      })\n    }\n    return out\n  }\n}\n\nexport default AuthOrchestratorAddon\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAgDA,IAAa,wBAAb,cAA2C,gBAAA,UAAiC;CAC1E,cAAc;EACZ,MAAM,EAAE,CAAC;;CAGX,MAAgB,eAAgD;EAC9D,MAAM,WAAoC;GACxC,eAAe,YAAY,KAAK,eAAe;GAC/C,oBAAoB,YAAY;IAM9B,OAAO,EAAE,SAAS,MAAe;;GAEpC;EACD,KAAK,IAAI,OAAO,KAAK,0CAA0C;EAC/D,OAAO,CAAC;GAAE,YAAY,gBAAA;GAA0B;GAAU,CAAC;;CAG7D,MAAc,gBAAsD;EAClE,MAAM,UAAU,KAAK,cAAc,qBAAmD,gBAAgB,IAAI,EAAE;EAC5G,MAAM,MAA0B,EAAE;EAClC,KAAK,MAAM,CAAC,SAAS,QAAQ,SAAS;GAIpC,IAAI,KAAK,aAAa,IAAI,UAAU,SAAS,GAAG;IAC9C,KAAK,MAAM,QAAQ,IAAI,WACrB,IAAI,KAAK;KACP,SAAS,IAAI,WAAW;KACxB,YAAY,KAAK;KACjB,aAAa,KAAK;KAClB,GAAI,KAAK,SAAS,KAAA,IAAY,EAAE,MAAM,KAAK,MAAM,GAAG,EAAE;KACtD,iBAAiB,KAAK;KACtB,mBAAmB,KAAK;KACxB,GAAI,KAAK,SAAS,KAAA,IAAY,EAAE,MAAM,KAAK,MAAM,GAAG,EAAE;KACtD,GAAI,KAAK,WAAW,KAAA,IAAY,EAAE,QAAQ,KAAK,QAAQ,GAAG,EAAE;KAC5D,SAAS;KACV,CAAC;IAEJ;;GAEF,IAAI,KAAK;IACP,SAAS,KAAK,WAAW;IACzB,aAAa,KAAK,eAAe;IACjC,GAAI,KAAK,SAAS,KAAA,IAAY,EAAE,MAAM,IAAI,MAAM,GAAG,EAAE;IACrD,iBAAiB,KAAK,mBAAmB;IACzC,mBAAmB,KAAK,qBAAsB,YAAY;IAC1D,GAAI,KAAK,SAAS,KAAA,IAAY,EAAE,MAAM,IAAI,MAAM,GAAG,EAAE;IACrD,GAAI,KAAK,WAAW,KAAA,IAAY,EAAE,QAAQ,IAAI,QAAQ,GAAG,EAAE;IAC3D,SAAS;IACV,CAAC;;EAEJ,OAAO"}

package/dist/builtins/auth-orchestrator/auth-orchestrator.addon.mjs

@@ -1,69 +0,0 @@
-import { BaseAddon, authenticationCapability } from "@camstack/types";
-//#region src/builtins/auth-orchestrator/auth-orchestrator.addon.ts
-/**
-* Authentication orchestrator — singleton facade over the
-* `auth-provider` collection. Mirrors the backup-orchestrator pattern:
-* UI consumers go through this builtin, which walks the
-* `auth-provider` collection registered by `local-auth` and any
-* additional `auth-*` addons (OIDC, SAML, LDAP, …) and returns a
-* curated view.
-*
-* The actual login flow still goes through `auth-provider`
-* collection methods (validateCredentials / getLoginUrl / …); this
-* cap exists so the admin UI's "Authentication" page and the login
-* screen's provider picker have ONE place to query instead of
-* walking the collection themselves.
-*/
-var AuthOrchestratorAddon = class extends BaseAddon {
-	constructor() {
-		super({});
-	}
-	async onInitialize() {
-		const provider = {
-			listProviders: async () => this.listProviders(),
-			setProviderEnabled: async () => {
-				return { success: true };
-			}
-		};
-		this.ctx.logger.info("Authentication orchestrator initialized");
-		return [{
-			capability: authenticationCapability,
-			provider
-		}];
-	}
-	async listProviders() {
-		const entries = this.capabilities?.getCollectionEntries("auth-provider") ?? [];
-		const out = [];
-		for (const [addonId, raw] of entries) {
-			if (raw?.instances && raw.instances.length > 0) {
-				for (const inst of raw.instances) out.push({
-					addonId: raw.addonId ?? addonId,
-					instanceId: inst.instanceId,
-					displayName: inst.displayName,
-					...inst.icon !== void 0 ? { icon: inst.icon } : {},
-					hasRedirectFlow: inst.hasRedirectFlow,
-					hasCredentialFlow: inst.hasCredentialFlow,
-					...inst.kind !== void 0 ? { kind: inst.kind } : {},
-					...inst.status !== void 0 ? { status: inst.status } : {},
-					enabled: true
-				});
-				continue;
-			}
-			out.push({
-				addonId: raw?.addonId ?? addonId,
-				displayName: raw?.displayName ?? addonId,
-				...raw?.icon !== void 0 ? { icon: raw.icon } : {},
-				hasRedirectFlow: raw?.hasRedirectFlow ?? false,
-				hasCredentialFlow: raw?.hasCredentialFlow ?? addonId === "local-auth",
-				...raw?.kind !== void 0 ? { kind: raw.kind } : {},
-				...raw?.status !== void 0 ? { status: raw.status } : {},
-				enabled: true
-			});
-		}
-		return out;
-	}
-};
-//#endregion
-export { AuthOrchestratorAddon, AuthOrchestratorAddon as default };
-
-//# sourceMappingURL=auth-orchestrator.addon.mjs.map

package/dist/builtins/auth-orchestrator/auth-orchestrator.addon.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-orchestrator.addon.mjs","names":[],"sources":["../../../src/builtins/auth-orchestrator/auth-orchestrator.addon.ts"],"sourcesContent":["/**\n * Authentication orchestrator — singleton facade over the\n * `auth-provider` collection. Mirrors the backup-orchestrator pattern:\n * UI consumers go through this builtin, which walks the\n * `auth-provider` collection registered by `local-auth` and any\n * additional `auth-*` addons (OIDC, SAML, LDAP, …) and returns a\n * curated view.\n *\n * The actual login flow still goes through `auth-provider`\n * collection methods (validateCredentials / getLoginUrl / …); this\n * cap exists so the admin UI's \"Authentication\" page and the login\n * screen's provider picker have ONE place to query instead of\n * walking the collection themselves.\n */\nimport {\n  BaseAddon,\n  authenticationCapability,\n  type AuthProviderInfo,\n  type IAuthenticationProvider,\n  type ProviderRegistration,\n} from '@camstack/types'\n\ninterface AuthProviderRegistrationLike {\n  readonly addonId?: string\n  readonly displayName?: string\n  readonly icon?: string\n  readonly hasRedirectFlow?: boolean\n  readonly hasCredentialFlow?: boolean\n  readonly kind?: string\n  readonly status?: string\n  /**\n   * Multi-instance fan-out. When set, the orchestrator emits ONE\n   * AuthProviderInfo per entry instead of a single one for the\n   * collection entry. Used by addons that host multiple logical IdPs\n   * within a single install (the OIDC addon supports Google +\n   * Microsoft + custom from one installation).\n   */\n  readonly instances?: ReadonlyArray<{\n    readonly instanceId: string\n    readonly displayName: string\n    readonly icon?: string\n    readonly hasRedirectFlow: boolean\n    readonly hasCredentialFlow: boolean\n    readonly kind?: string\n    readonly status?: string\n  }>\n}\n\nexport class AuthOrchestratorAddon extends BaseAddon<Record<string, never>> {\n  constructor() {\n    super({})\n  }\n\n  protected async onInitialize(): Promise<ProviderRegistration[]> {\n    const provider: IAuthenticationProvider = {\n      listProviders: async () => this.listProviders(),\n      setProviderEnabled: async () => {\n        // Persistence is per-addon today — operators toggle enabled\n        // via the provider addon's own settings panel. The orchestrator\n        // exposes the affordance for forward-compat (UI may move the\n        // enabled toggle into the Authentication page later) but\n        // currently no-ops the persistence side.\n        return { success: true as const }\n      },\n    }\n    this.ctx.logger.info('Authentication orchestrator initialized')\n    return [{ capability: authenticationCapability, provider }]\n  }\n\n  private async listProviders(): Promise<readonly AuthProviderInfo[]> {\n    const entries = this.capabilities?.getCollectionEntries<AuthProviderRegistrationLike>('auth-provider') ?? []\n    const out: AuthProviderInfo[] = []\n    for (const [addonId, raw] of entries) {\n      // Multi-instance: emit one entry per declared instance, preserving\n      // the parent `addonId` so the login URL keeps `/addon/<addonId>/...`\n      // while adding the `instanceId` path segment downstream.\n      if (raw?.instances && raw.instances.length > 0) {\n        for (const inst of raw.instances) {\n          out.push({\n            addonId: raw.addonId ?? addonId,\n            instanceId: inst.instanceId,\n            displayName: inst.displayName,\n            ...(inst.icon !== undefined ? { icon: inst.icon } : {}),\n            hasRedirectFlow: inst.hasRedirectFlow,\n            hasCredentialFlow: inst.hasCredentialFlow,\n            ...(inst.kind !== undefined ? { kind: inst.kind } : {}),\n            ...(inst.status !== undefined ? { status: inst.status } : {}),\n            enabled: true,\n          })\n        }\n        continue\n      }\n      out.push({\n        addonId: raw?.addonId ?? addonId,\n        displayName: raw?.displayName ?? addonId,\n        ...(raw?.icon !== undefined ? { icon: raw.icon } : {}),\n        hasRedirectFlow: raw?.hasRedirectFlow ?? false,\n        hasCredentialFlow: raw?.hasCredentialFlow ?? (addonId === 'local-auth'),\n        ...(raw?.kind !== undefined ? { kind: raw.kind } : {}),\n        ...(raw?.status !== undefined ? { status: raw.status } : {}),\n        enabled: true,\n      })\n    }\n    return out\n  }\n}\n\nexport default AuthOrchestratorAddon\n"],"mappings":";;;;;;;;;;;;;;;;AAgDA,IAAa,wBAAb,cAA2C,UAAiC;CAC1E,cAAc;EACZ,MAAM,EAAE,CAAC;;CAGX,MAAgB,eAAgD;EAC9D,MAAM,WAAoC;GACxC,eAAe,YAAY,KAAK,eAAe;GAC/C,oBAAoB,YAAY;IAM9B,OAAO,EAAE,SAAS,MAAe;;GAEpC;EACD,KAAK,IAAI,OAAO,KAAK,0CAA0C;EAC/D,OAAO,CAAC;GAAE,YAAY;GAA0B;GAAU,CAAC;;CAG7D,MAAc,gBAAsD;EAClE,MAAM,UAAU,KAAK,cAAc,qBAAmD,gBAAgB,IAAI,EAAE;EAC5G,MAAM,MAA0B,EAAE;EAClC,KAAK,MAAM,CAAC,SAAS,QAAQ,SAAS;GAIpC,IAAI,KAAK,aAAa,IAAI,UAAU,SAAS,GAAG;IAC9C,KAAK,MAAM,QAAQ,IAAI,WACrB,IAAI,KAAK;KACP,SAAS,IAAI,WAAW;KACxB,YAAY,KAAK;KACjB,aAAa,KAAK;KAClB,GAAI,KAAK,SAAS,KAAA,IAAY,EAAE,MAAM,KAAK,MAAM,GAAG,EAAE;KACtD,iBAAiB,KAAK;KACtB,mBAAmB,KAAK;KACxB,GAAI,KAAK,SAAS,KAAA,IAAY,EAAE,MAAM,KAAK,MAAM,GAAG,EAAE;KACtD,GAAI,KAAK,WAAW,KAAA,IAAY,EAAE,QAAQ,KAAK,QAAQ,GAAG,EAAE;KAC5D,SAAS;KACV,CAAC;IAEJ;;GAEF,IAAI,KAAK;IACP,SAAS,KAAK,WAAW;IACzB,aAAa,KAAK,eAAe;IACjC,GAAI,KAAK,SAAS,KAAA,IAAY,EAAE,MAAM,IAAI,MAAM,GAAG,EAAE;IACrD,iBAAiB,KAAK,mBAAmB;IACzC,mBAAmB,KAAK,qBAAsB,YAAY;IAC1D,GAAI,KAAK,SAAS,KAAA,IAAY,EAAE,MAAM,IAAI,MAAM,GAAG,EAAE;IACrD,GAAI,KAAK,WAAW,KAAA,IAAY,EAAE,QAAQ,IAAI,QAAQ,GAAG,EAAE;IAC3D,SAAS;IACV,CAAC;;EAEJ,OAAO"}

package/dist/builtins/auth-orchestrator/index.d.ts

@@ -1,2 +0,0 @@
-export { AuthOrchestratorAddon, default } from './auth-orchestrator.addon.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/builtins/auth-orchestrator/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/builtins/auth-orchestrator/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA"}

package/dist/builtins/auth-orchestrator/index.js

@@ -1,7 +0,0 @@
-Object.defineProperties(exports, {
-	__esModule: { value: true },
-	[Symbol.toStringTag]: { value: "Module" }
-});
-const require_builtins_auth_orchestrator_auth_orchestrator_addon = require("./auth-orchestrator.addon.js");
-exports.AuthOrchestratorAddon = require_builtins_auth_orchestrator_auth_orchestrator_addon.AuthOrchestratorAddon;
-exports.default = require_builtins_auth_orchestrator_auth_orchestrator_addon.AuthOrchestratorAddon;

package/dist/builtins/auth-orchestrator/index.mjs

@@ -1,2 +0,0 @@
-import { AuthOrchestratorAddon } from "./auth-orchestrator.addon.mjs";
-export { AuthOrchestratorAddon, AuthOrchestratorAddon as default };

package/dist/builtins/mesh-orchestrator/index.d.ts

@@ -1,2 +0,0 @@
-export { MeshOrchestratorAddon, default } from './mesh-orchestrator.addon.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/builtins/mesh-orchestrator/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/builtins/mesh-orchestrator/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA"}

package/dist/builtins/mesh-orchestrator/index.js

@@ -1,7 +0,0 @@
-Object.defineProperties(exports, {
-	__esModule: { value: true },
-	[Symbol.toStringTag]: { value: "Module" }
-});
-const require_builtins_mesh_orchestrator_mesh_orchestrator_addon = require("./mesh-orchestrator.addon.js");
-exports.MeshOrchestratorAddon = require_builtins_mesh_orchestrator_mesh_orchestrator_addon.MeshOrchestratorAddon;
-exports.default = require_builtins_mesh_orchestrator_mesh_orchestrator_addon.MeshOrchestratorAddon;

package/dist/builtins/mesh-orchestrator/index.mjs

@@ -1,2 +0,0 @@
-import { MeshOrchestratorAddon } from "./mesh-orchestrator.addon.mjs";
-export { MeshOrchestratorAddon, MeshOrchestratorAddon as default };

package/dist/builtins/mesh-orchestrator/mesh-orchestrator.addon.d.ts

@@ -1,9 +0,0 @@
-import { BaseAddon, ProviderRegistration } from '@camstack/types';
-export declare class MeshOrchestratorAddon extends BaseAddon<Record<string, never>> {
-    constructor();
-    protected onInitialize(): Promise<ProviderRegistration[]>;
-    private resolveImpl;
-    private listProviders;
-}
-export default MeshOrchestratorAddon;
-//# sourceMappingURL=mesh-orchestrator.addon.d.ts.map

package/dist/builtins/mesh-orchestrator/mesh-orchestrator.addon.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mesh-orchestrator.addon.d.ts","sourceRoot":"","sources":["../../../src/builtins/mesh-orchestrator/mesh-orchestrator.addon.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,SAAS,EAKT,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAA;AAqCxB,qBAAa,qBAAsB,SAAQ,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;;cAKzD,YAAY,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAsC/D,OAAO,CAAC,WAAW;YAML,aAAa;CAqD5B;AAED,eAAe,qBAAqB,CAAA"}

package/dist/builtins/mesh-orchestrator/mesh-orchestrator.addon.js

@@ -1,113 +0,0 @@
-Object.defineProperties(exports, {
-	__esModule: { value: true },
-	[Symbol.toStringTag]: { value: "Module" }
-});
-require("../../chunk-C13QxCFV.js");
-let _camstack_types = require("@camstack/types");
-//#region src/builtins/mesh-orchestrator/mesh-orchestrator.addon.ts
-/**
-* Mesh orchestrator — singleton facade over the `mesh-network`
-* collection. One row per provider (Tailscale, Headscale, ZeroTier),
-* aggregated for the admin UI's Mesh Networks page.
-*/
-var MeshOrchestratorAddon = class extends _camstack_types.BaseAddon {
-	constructor() {
-		super({});
-	}
-	async onInitialize() {
-		const provider = {
-			listProviders: async () => this.listProviders(),
-			joinProvider: async ({ addonId, authKey, hostname }) => {
-				const impl = this.resolveImpl(addonId);
-				if (!impl?.join) throw new Error(`Mesh provider "${addonId}" does not support join`);
-				return await impl.join({
-					authKey,
-					...hostname ? { hostname } : {}
-				});
-			},
-			leaveProvider: async ({ addonId }) => {
-				const impl = this.resolveImpl(addonId);
-				if (impl?.leave) await impl.leave();
-				return { success: true };
-			},
-			startLoginProvider: async ({ addonId, hostname }) => {
-				const impl = this.resolveImpl(addonId);
-				if (!impl?.startLogin) throw new Error(`Mesh provider "${addonId}" does not support startLogin`);
-				return await impl.startLogin(hostname ? { hostname } : {});
-			},
-			logoutProvider: async ({ addonId }) => {
-				const impl = this.resolveImpl(addonId);
-				if (!impl?.logout) throw new Error(`Mesh provider "${addonId}" does not support logout`);
-				await impl.logout();
-				return { loggedOut: true };
-			},
-			listProviderPeers: async ({ addonId }) => {
-				const impl = this.resolveImpl(addonId);
-				if (!impl?.listPeers) return { peers: [] };
-				return await impl.listPeers();
-			}
-		};
-		this.ctx.logger.info("Mesh orchestrator initialized");
-		return [{
-			capability: _camstack_types.meshOrchestratorCapability,
-			provider
-		}];
-	}
-	resolveImpl(addonId) {
-		return (this.capabilities?.getCollectionEntries("mesh-network") ?? []).find(([id]) => id === addonId)?.[1] ?? null;
-	}
-	async listProviders() {
-		const entries = this.capabilities?.getCollectionEntries("mesh-network") ?? [];
-		const out = [];
-		for (const [addonId, impl] of entries) {
-			let joined = false;
-			let meshIp = "";
-			let magicDnsHostname = "";
-			let peerCount = 0;
-			let endpoints = [];
-			let error;
-			let tenantName = "";
-			let magicDnsSuffix = "";
-			let userLogin = null;
-			let controlPlaneUrl = "";
-			let keyExpiry = null;
-			if (impl.getStatus) try {
-				const s = await impl.getStatus();
-				joined = s.joined;
-				meshIp = s.meshIp;
-				magicDnsHostname = s.magicDnsHostname;
-				peerCount = s.peerCount;
-				endpoints = s.endpoints;
-				error = s.error;
-				tenantName = s.tenantName;
-				magicDnsSuffix = s.magicDnsSuffix;
-				userLogin = s.userLogin;
-				controlPlaneUrl = s.controlPlaneUrl;
-				keyExpiry = s.keyExpiry;
-			} catch (err) {
-				error = err instanceof Error ? err.message : String(err);
-			}
-			out.push({
-				addonId,
-				displayName: impl.displayName ?? addonId,
-				joined,
-				meshIp,
-				magicDnsHostname,
-				peerCount,
-				endpoints,
-				...error !== void 0 ? { error } : {},
-				tenantName,
-				magicDnsSuffix,
-				userLogin,
-				controlPlaneUrl,
-				keyExpiry
-			});
-		}
-		return out;
-	}
-};
-//#endregion
-exports.MeshOrchestratorAddon = MeshOrchestratorAddon;
-exports.default = MeshOrchestratorAddon;
-
-//# sourceMappingURL=mesh-orchestrator.addon.js.map

package/dist/builtins/mesh-orchestrator/mesh-orchestrator.addon.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mesh-orchestrator.addon.js","names":[],"sources":["../../../src/builtins/mesh-orchestrator/mesh-orchestrator.addon.ts"],"sourcesContent":["/**\n * Mesh orchestrator — singleton facade over the `mesh-network`\n * collection. One row per provider (Tailscale, Headscale, ZeroTier),\n * aggregated for the admin UI's Mesh Networks page.\n */\nimport {\n  BaseAddon,\n  meshOrchestratorCapability,\n  type IMeshOrchestrator,\n  type MeshPeer,\n  type MeshProviderInfo,\n  type ProviderRegistration,\n} from '@camstack/types'\n\ninterface MeshStatusLike {\n  joined: boolean\n  meshIp: string\n  magicDnsHostname: string\n  peerCount: number\n  endpoints: readonly {\n    id: string\n    label: string\n    scope: 'mesh' | 'public'\n    url: string\n    hostname: string\n    port: number\n    protocol: 'http' | 'https'\n  }[]\n  error?: string\n  tenantName: string\n  magicDnsSuffix: string\n  userLogin: string | null\n  controlPlaneUrl: string\n  keyExpiry: number | null\n}\n\ninterface MeshNetworkLike {\n  getStatus?: () => Promise<MeshStatusLike>\n  join?: (input: { authKey: string; hostname?: string }) => Promise<{ joined: true }>\n  startLogin?: (input: { hostname?: string }) => Promise<{ loginUrl: string }>\n  leave?: () => Promise<{ left: true }>\n  logout?: () => Promise<{ loggedOut: true }>\n  listPeers?: () => Promise<{ peers: readonly MeshPeer[] }>\n}\n\ninterface MeshRegistrationMeta {\n  readonly displayName?: string\n}\n\nexport class MeshOrchestratorAddon extends BaseAddon<Record<string, never>> {\n  constructor() {\n    super({})\n  }\n\n  protected async onInitialize(): Promise<ProviderRegistration[]> {\n    const provider: IMeshOrchestrator = {\n      listProviders: async () => this.listProviders(),\n      joinProvider: async ({ addonId, authKey, hostname }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.join) throw new Error(`Mesh provider \"${addonId}\" does not support join`)\n        return await impl.join({ authKey, ...(hostname ? { hostname } : {}) })\n      },\n      leaveProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (impl?.leave) await impl.leave()\n        return { success: true as const }\n      },\n      startLoginProvider: async ({ addonId, hostname }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.startLogin) {\n          throw new Error(`Mesh provider \"${addonId}\" does not support startLogin`)\n        }\n        return await impl.startLogin(hostname ? { hostname } : {})\n      },\n      logoutProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.logout) {\n          throw new Error(`Mesh provider \"${addonId}\" does not support logout`)\n        }\n        await impl.logout()\n        return { loggedOut: true as const }\n      },\n      listProviderPeers: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.listPeers) return { peers: [] }\n        return await impl.listPeers()\n      },\n    }\n    this.ctx.logger.info('Mesh orchestrator initialized')\n    return [{ capability: meshOrchestratorCapability, provider }]\n  }\n\n  private resolveImpl(addonId: string): MeshNetworkLike | null {\n    const entries = this.capabilities?.getCollectionEntries<MeshNetworkLike>('mesh-network') ?? []\n    const found = entries.find(([id]) => id === addonId)\n    return found?.[1] ?? null\n  }\n\n  private async listProviders(): Promise<readonly MeshProviderInfo[]> {\n    const entries = this.capabilities?.getCollectionEntries<MeshNetworkLike & MeshRegistrationMeta>(\n      'mesh-network',\n    ) ?? []\n    const out: MeshProviderInfo[] = []\n    for (const [addonId, impl] of entries) {\n      let joined = false\n      let meshIp = ''\n      let magicDnsHostname = ''\n      let peerCount = 0\n      let endpoints: MeshProviderInfo['endpoints'] = []\n      let error: string | undefined\n      let tenantName = ''\n      let magicDnsSuffix = ''\n      let userLogin: string | null = null\n      let controlPlaneUrl = ''\n      let keyExpiry: number | null = null\n      if (impl.getStatus) {\n        try {\n          const s = await impl.getStatus()\n          joined = s.joined\n          meshIp = s.meshIp\n          magicDnsHostname = s.magicDnsHostname\n          peerCount = s.peerCount\n          endpoints = s.endpoints\n          error = s.error\n          tenantName = s.tenantName\n          magicDnsSuffix = s.magicDnsSuffix\n          userLogin = s.userLogin\n          controlPlaneUrl = s.controlPlaneUrl\n          keyExpiry = s.keyExpiry\n        } catch (err) {\n          error = err instanceof Error ? err.message : String(err)\n        }\n      }\n      out.push({\n        addonId,\n        displayName: impl.displayName ?? addonId,\n        joined,\n        meshIp,\n        magicDnsHostname,\n        peerCount,\n        endpoints,\n        ...(error !== undefined ? { error } : {}),\n        tenantName,\n        magicDnsSuffix,\n        userLogin,\n        controlPlaneUrl,\n        keyExpiry,\n      })\n    }\n    return out\n  }\n}\n\nexport default MeshOrchestratorAddon\n"],"mappings":";;;;;;;;;;;;AAiDA,IAAa,wBAAb,cAA2C,gBAAA,UAAiC;CAC1E,cAAc;EACZ,MAAM,EAAE,CAAC;;CAGX,MAAgB,eAAgD;EAC9D,MAAM,WAA8B;GAClC,eAAe,YAAY,KAAK,eAAe;GAC/C,cAAc,OAAO,EAAE,SAAS,SAAS,eAAe;IACtD,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,MAAM,MAAM,IAAI,MAAM,kBAAkB,QAAQ,yBAAyB;IACpF,OAAO,MAAM,KAAK,KAAK;KAAE;KAAS,GAAI,WAAW,EAAE,UAAU,GAAG,EAAE;KAAG,CAAC;;GAExE,eAAe,OAAO,EAAE,cAAc;IACpC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,MAAM,OAAO,MAAM,KAAK,OAAO;IACnC,OAAO,EAAE,SAAS,MAAe;;GAEnC,oBAAoB,OAAO,EAAE,SAAS,eAAe;IACnD,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,YACT,MAAM,IAAI,MAAM,kBAAkB,QAAQ,+BAA+B;IAE3E,OAAO,MAAM,KAAK,WAAW,WAAW,EAAE,UAAU,GAAG,EAAE,CAAC;;GAE5D,gBAAgB,OAAO,EAAE,cAAc;IACrC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,QACT,MAAM,IAAI,MAAM,kBAAkB,QAAQ,2BAA2B;IAEvE,MAAM,KAAK,QAAQ;IACnB,OAAO,EAAE,WAAW,MAAe;;GAErC,mBAAmB,OAAO,EAAE,cAAc;IACxC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,WAAW,OAAO,EAAE,OAAO,EAAE,EAAE;IAC1C,OAAO,MAAM,KAAK,WAAW;;GAEhC;EACD,KAAK,IAAI,OAAO,KAAK,gCAAgC;EACrD,OAAO,CAAC;GAAE,YAAY,gBAAA;GAA4B;GAAU,CAAC;;CAG/D,YAAoB,SAAyC;EAG3D,QAFgB,KAAK,cAAc,qBAAsC,eAAe,IAAI,EAAE,EACxE,MAAM,CAAC,QAAQ,OAAO,QACrC,GAAQ,MAAM;;CAGvB,MAAc,gBAAsD;EAClE,MAAM,UAAU,KAAK,cAAc,qBACjC,eACD,IAAI,EAAE;EACP,MAAM,MAA0B,EAAE;EAClC,KAAK,MAAM,CAAC,SAAS,SAAS,SAAS;GACrC,IAAI,SAAS;GACb,IAAI,SAAS;GACb,IAAI,mBAAmB;GACvB,IAAI,YAAY;GAChB,IAAI,YAA2C,EAAE;GACjD,IAAI;GACJ,IAAI,aAAa;GACjB,IAAI,iBAAiB;GACrB,IAAI,YAA2B;GAC/B,IAAI,kBAAkB;GACtB,IAAI,YAA2B;GAC/B,IAAI,KAAK,WACP,IAAI;IACF,MAAM,IAAI,MAAM,KAAK,WAAW;IAChC,SAAS,EAAE;IACX,SAAS,EAAE;IACX,mBAAmB,EAAE;IACrB,YAAY,EAAE;IACd,YAAY,EAAE;IACd,QAAQ,EAAE;IACV,aAAa,EAAE;IACf,iBAAiB,EAAE;IACnB,YAAY,EAAE;IACd,kBAAkB,EAAE;IACpB,YAAY,EAAE;YACP,KAAK;IACZ,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;;GAG5D,IAAI,KAAK;IACP;IACA,aAAa,KAAK,eAAe;IACjC;IACA;IACA;IACA;IACA;IACA,GAAI,UAAU,KAAA,IAAY,EAAE,OAAO,GAAG,EAAE;IACxC;IACA;IACA;IACA;IACA;IACD,CAAC;;EAEJ,OAAO"}